Merge pull request '1.0.0' (#4) from develop into master
Reviewed-on: #4
This commit is contained in:
commit
e0da513893
148
.drone.yml
148
.drone.yml
@ -1,21 +1,38 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: build-multiarch-images
|
||||
name: build-release-images
|
||||
trigger:
|
||||
event:
|
||||
exclude:
|
||||
- pull_request
|
||||
ref:
|
||||
- refs/tags/**
|
||||
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
steps:
|
||||
|
||||
- name: get-tags
|
||||
image: docker:git
|
||||
commands:
|
||||
- git fetch --tags
|
||||
depends_on:
|
||||
- clone
|
||||
|
||||
- name: make-tags
|
||||
image: node
|
||||
commands:
|
||||
- echo -n "${DRONE_COMMIT_SHA:0:10}, latest" > .tags
|
||||
- echo -n "${DRONE_TAG}, latest" > .tags
|
||||
depends_on:
|
||||
- get-tags
|
||||
|
||||
- name: build
|
||||
- name: build-gitea
|
||||
image: thegeeklab/drone-docker-buildx
|
||||
privileged: true
|
||||
settings:
|
||||
provenance: false
|
||||
registry: git.mrmeeb.stream
|
||||
username:
|
||||
from_secret: docker_username
|
||||
@ -25,16 +42,135 @@ steps:
|
||||
platforms:
|
||||
- linux/arm64
|
||||
- linux/amd64
|
||||
depends_on:
|
||||
- make-tags
|
||||
|
||||
- name: release-gitea
|
||||
image: goreleaser/goreleaser
|
||||
environment:
|
||||
GITEA_TOKEN:
|
||||
from_secret: gitea_token
|
||||
commands:
|
||||
- goreleaser release -f .goreleaser-gitea.yaml
|
||||
depends_on:
|
||||
- build-gitea
|
||||
|
||||
- name: notify
|
||||
image: plugins/slack
|
||||
when:
|
||||
status:
|
||||
- success
|
||||
- failure
|
||||
settings:
|
||||
webhook:
|
||||
from_secret: slack_webhook
|
||||
depends_on:
|
||||
- release-gitea
|
||||
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: build-main-images
|
||||
trigger:
|
||||
branch:
|
||||
- master
|
||||
event:
|
||||
exclude:
|
||||
- pull_request
|
||||
- pull_request
|
||||
ref:
|
||||
- refs/heads/master
|
||||
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
steps:
|
||||
|
||||
- name: make-tags
|
||||
image: node
|
||||
commands:
|
||||
- echo -n "${DRONE_COMMIT_SHA:0:8}, latest" > .tags
|
||||
when:
|
||||
ref:
|
||||
- refs/heads/master
|
||||
depends_on:
|
||||
- clone
|
||||
|
||||
- name: build-gitea
|
||||
image: thegeeklab/drone-docker-buildx
|
||||
privileged: true
|
||||
settings:
|
||||
provenance: false
|
||||
registry: git.mrmeeb.stream
|
||||
username:
|
||||
from_secret: docker_username
|
||||
password:
|
||||
from_secret: docker_password
|
||||
repo: git.mrmeeb.stream/mrmeeb/certbot-cron
|
||||
platforms:
|
||||
- linux/arm64
|
||||
- linux/amd64
|
||||
depends_on:
|
||||
- make-tags
|
||||
|
||||
- name: notify
|
||||
image: plugins/slack
|
||||
when:
|
||||
status:
|
||||
- success
|
||||
- failure
|
||||
settings:
|
||||
webhook:
|
||||
from_secret: slack_webhook
|
||||
depends_on:
|
||||
- build-gitea
|
||||
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: build-develop-images
|
||||
trigger:
|
||||
event:
|
||||
exclude:
|
||||
- pull_request
|
||||
branch:
|
||||
- develop
|
||||
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
steps:
|
||||
# Set tags for develop branch - git commit SHA and 'develop'
|
||||
- name: make-tags
|
||||
image: node
|
||||
commands:
|
||||
- echo -n "develop-${DRONE_COMMIT_SHA:0:8}, develop" > .tags
|
||||
|
||||
# Build containers from develop branch
|
||||
- name: build-gitea
|
||||
image: thegeeklab/drone-docker-buildx
|
||||
privileged: true
|
||||
settings:
|
||||
provenance: false
|
||||
registry: git.mrmeeb.stream
|
||||
username:
|
||||
from_secret: docker_username
|
||||
password:
|
||||
from_secret: docker_password
|
||||
repo: git.mrmeeb.stream/mrmeeb/certbot-cron
|
||||
platforms:
|
||||
- linux/arm64
|
||||
- linux/amd64
|
||||
depends_on:
|
||||
- make-tags
|
||||
|
||||
- name: notify
|
||||
image: plugins/slack
|
||||
when:
|
||||
status:
|
||||
- success
|
||||
- failure
|
||||
settings:
|
||||
webhook:
|
||||
from_secret: slack_webhook
|
||||
depends_on:
|
||||
- build-gitea
|
||||
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
dist-gitea/
|
||||
.tags
|
||||
28
.goreleaser-gitea.yaml
Normal file
28
.goreleaser-gitea.yaml
Normal file
@ -0,0 +1,28 @@
|
||||
|
||||
dist: dist-gitea
|
||||
|
||||
build:
|
||||
skip: true
|
||||
|
||||
archives:
|
||||
- format: binary
|
||||
|
||||
release:
|
||||
draft: true
|
||||
gitea:
|
||||
owner: MrMeeb
|
||||
name: certbot-cron-docker
|
||||
|
||||
changelog:
|
||||
sort: asc
|
||||
filters:
|
||||
exclude:
|
||||
- '^docs:'
|
||||
- '^test:'
|
||||
|
||||
# .goreleaser.yaml
|
||||
gitea_urls:
|
||||
api: https://git.mrmeeb.stream/api/v1
|
||||
download: https://git.mrmeeb.stream
|
||||
# set to true if you use a self-signed certificate
|
||||
skip_tls_verify: false
|
||||
56
Dockerfile
56
Dockerfile
@ -1,17 +1,15 @@
|
||||
FROM debian:bullseye-slim
|
||||
FROM alpine:latest as base
|
||||
ARG TARGETARCH
|
||||
|
||||
RUN apt update && apt install -y bash cron python3 python3-venv procps tini
|
||||
FROM base AS base-amd64
|
||||
ENV S6_OVERLAY_ARCH=x86_64
|
||||
|
||||
RUN python3 -m venv /opt/certbot/ && /opt/certbot/bin/pip install --upgrade pip
|
||||
FROM base AS base-arm64
|
||||
ENV S6_OVERLAY_ARCH=aarch64
|
||||
|
||||
RUN /opt/certbot/bin/pip install certbot certbot-dns-cloudflare && \
|
||||
ln -s /opt/certbot/bin/certbot /usr/bin/certbot
|
||||
FROM base-${TARGETARCH}${TARGETVARIANT}
|
||||
|
||||
RUN mkdir -p /config
|
||||
|
||||
COPY run.sh / renew.sh /
|
||||
|
||||
RUN chmod +x /run.sh /renew.sh
|
||||
ARG S6_OVERLAY_VERSION=3.1.5.0
|
||||
|
||||
ENV DOMAINS=
|
||||
ENV EMAIL=
|
||||
@ -19,6 +17,42 @@ ENV INTERVAL="0 */6 * * *"
|
||||
ENV STAGING=false
|
||||
ENV PROPOGATION_TIME=10
|
||||
ENV GENERATE_DHPARAM=true
|
||||
ENV TZ=UTC
|
||||
ENV PUID=1000
|
||||
ENV PGID=1000
|
||||
ENV CLOUDFLARE_TOKEN=
|
||||
|
||||
ENTRYPOINT ["/usr/bin/tini", "-s", "/run.sh"]
|
||||
#Get required packages
|
||||
RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
|
||||
|
||||
#Make folders
|
||||
RUN mkdir /config && \
|
||||
mkdir /app && \
|
||||
#Create default user
|
||||
useradd -u 1000 -U -d /config -s /bin/false mrmeeb && \
|
||||
usermod -G users mrmeeb
|
||||
|
||||
#Install s6-overlay
|
||||
RUN curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar Jpxf - -C / && \
|
||||
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar Jpxf - -C / && \
|
||||
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz" | tar Jpxf - -C / && \
|
||||
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz" | tar Jpxf - -C /
|
||||
ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSITY=1
|
||||
|
||||
RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
|
||||
|
||||
#Get required packages for building, build, then cleanup
|
||||
RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
|
||||
/app/certbot/bin/pip install certbot certbot-dns-cloudflare && \
|
||||
ln -s /app/certbot/bin/certbot /usr/bin/certbot &&\
|
||||
apk del .deps
|
||||
|
||||
COPY root /
|
||||
|
||||
RUN chmod +x /container-init.sh && \
|
||||
chmod +x /certbot-prepare.sh && \
|
||||
chmod +x /certbot-renew.sh && \
|
||||
chown -R ${PUID}:${PGID} /app /config
|
||||
|
||||
ENTRYPOINT [ "/init" ]
|
||||
|
||||
|
||||
34
README.md
34
README.md
@ -1,8 +1,15 @@
|
||||
# Certbot Cron Docker
|
||||
|
||||
[](https://drone.mrmeeb.stream/MrMeeb/certbot-cron-docker)
|
||||
 
|
||||
|
||||
Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours.
|
||||
Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours by default.
|
||||
|
||||
## Tags
|
||||
|
||||
|Tag |Description|
|
||||
|-------|-----------|
|
||||
|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
|
||||
|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
|
||||
|
||||
## Running
|
||||
|
||||
@ -11,6 +18,7 @@ Dockerised Certbot that utilises cron to schedule creating and renewing SSL cert
|
||||
docker run -d --name certbot \
|
||||
-e EMAIL=admin@domain.com \
|
||||
-e DOMAINS=domain.com \
|
||||
-e CLOUDFLARE_TOKEN=123abc
|
||||
-v /docker/certbot-cron:/config \
|
||||
git.mrmeeb.stream/mrmeeb/certbot-cron:latest
|
||||
```
|
||||
@ -28,19 +36,23 @@ services:
|
||||
environment:
|
||||
- EMAIL=admin@domain.com
|
||||
- DOMAINS=domain.com,*.domain.com
|
||||
- CLOUDFLARE_TOKEN=123abc
|
||||
```
|
||||
|
||||
## Environment Variables:
|
||||
|
||||
| Variable | Default Value | Description |
|
||||
| --- | --- | --- |
|
||||
|PUID |int |1000 |Sets the UID of the user certbot runs under |
|
||||
|PGID |int |1000 |Sets the GID of the user certbot runs under |
|
||||
|TZ |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) |UTC |Sets the timezone of the container |
|
||||
| EMAIL | None | Email address for renewal information & other communications |
|
||||
| DOMAINS | None | Domains to be included in the certificate. Comma separated list, no spaces. Wildcards supported |
|
||||
| INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax |
|
||||
| STAGING | false (case-sensitive) | Uses the LetsEncrypt staging endpoint for testing - avoids the aggressive rate-limiting of the production endpoint |
|
||||
| PROPOGATION_TIME | 10 | The amount of time (seconds) that certbot waits for the TXT records to propogate to Cloudflare before verifying - the more domains in the certificate, the longer you might need |
|
||||
| GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys |
|
||||
|
||||
| CLOUDFLARE_TOKEN | N/A | Cloudflare token for verification |
|
||||
|
||||
## Volumes
|
||||
|
||||
@ -48,22 +60,6 @@ services:
|
||||
| --- | --- |
|
||||
| /config | Stores configs and LetsEncrypt output for mounting in other containers
|
||||
|
||||
## Building
|
||||
|
||||
```
|
||||
git clone https://git.mrmeeb.stream/certbot-cron-docker
|
||||
|
||||
cd certbot-cron-docker
|
||||
|
||||
docker build -t certbot-cron .
|
||||
|
||||
docker run -d --name certbot-cron \
|
||||
-e EMAIL=admin@domain.com \
|
||||
-e DOMAINS=domain.com \
|
||||
-v /docker/certbot-cron:/config \
|
||||
certbot-cron
|
||||
```
|
||||
|
||||
## Other
|
||||
|
||||
Thanks to [this guy](https://stackoverflow.com/questions/63447441/docker-stop-for-crond-times-out) for explaining how to make cron actually shutdown when stopping the container.
|
||||
18
renew.sh
18
renew.sh
@ -1,18 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
echo "Attempting to renew certificates"
|
||||
if [[ $STAGING = true ]]
|
||||
then
|
||||
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
|
||||
certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Renewal attempt complete"
|
||||
elif [[ $STAGING = false ]]
|
||||
then
|
||||
echo "Using production endpoint"
|
||||
certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Renewal attempt complete"
|
||||
else
|
||||
echo "Unrecognised option for STAGING variable - check your configuration"
|
||||
|
||||
exit 8
|
||||
fi
|
||||
85
root/certbot-prepare.sh
Normal file
85
root/certbot-prepare.sh
Normal file
@ -0,0 +1,85 @@
|
||||
#!/command/with-contenv bash
|
||||
# shellcheck shell=bash
|
||||
|
||||
#Creating needed folders and files if they don't already exist
|
||||
if [ ! -d /config/.secrets ]
|
||||
then
|
||||
mkdir /config/.secrets
|
||||
fi
|
||||
|
||||
if [ ! -d /config/letsencrypt ]
|
||||
then
|
||||
mkdir /config/letsencrypt
|
||||
fi
|
||||
|
||||
if [ ! -d /config/letsencrypt/keys ]
|
||||
then
|
||||
mkdir /config/letsencrypt/keys
|
||||
fi
|
||||
|
||||
if [ ! -d /config/logs ]
|
||||
then
|
||||
mkdir /config/logs
|
||||
fi
|
||||
|
||||
if [ ! -f /config/logs/renew.log ]
|
||||
then
|
||||
touch /config/logs/renew.log
|
||||
fi
|
||||
|
||||
if [ ! -f /config/.crontab.txt ]
|
||||
then
|
||||
touch /config/.crontab.txt
|
||||
fi
|
||||
|
||||
if [ ! -f /config/.secrets/cloudflare.ini ]
|
||||
then
|
||||
touch /config/.secrets/cloudflare.ini
|
||||
fi
|
||||
|
||||
if [ -n "$CLOUDFLARE_TOKEN" ]
|
||||
then
|
||||
echo "Cloudflare token is present"
|
||||
|
||||
echo "dns_cloudflare_api_token = $CLOUDFLARE_TOKEN" > /config/.secrets/cloudflare.ini
|
||||
|
||||
fi
|
||||
|
||||
if [ ! -s /config/.secrets/cloudflare.ini ]
|
||||
then
|
||||
echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing. This can be done as an ENV var, or by editing the file directly"
|
||||
|
||||
exit 22
|
||||
fi
|
||||
|
||||
#Securing cloudflare.ini to supress warnings
|
||||
chmod 600 /config/.secrets/cloudflare.ini
|
||||
|
||||
echo "Creating certificates, or attempting to renew if they already exist"
|
||||
|
||||
if [[ $STAGING = true ]]
|
||||
then
|
||||
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
|
||||
certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Creation/renewal attempt complete"
|
||||
elif [[ $STAGING = false ]]
|
||||
then
|
||||
echo "Using production endpoint"
|
||||
certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Creation/renewal attempt complete"
|
||||
else
|
||||
echo "Unrecognised option for STAGING variable - check your configuration"
|
||||
|
||||
exit 22
|
||||
fi
|
||||
|
||||
if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
|
||||
then
|
||||
echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
|
||||
openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
|
||||
fi
|
||||
|
||||
echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt
|
||||
|
||||
echo "Starting automatic renewal job. Schedule is $INTERVAL"
|
||||
crontab /config/.crontab.txt
|
||||
20
root/certbot-renew.sh
Normal file
20
root/certbot-renew.sh
Normal file
@ -0,0 +1,20 @@
|
||||
#!/command/with-contenv bash
|
||||
# shellcheck shell=bash
|
||||
echo ''
|
||||
date
|
||||
echo "Attempting to renew certificates"
|
||||
if [[ $STAGING = true ]]
|
||||
then
|
||||
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
|
||||
certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Renewal attempt complete"
|
||||
elif [[ $STAGING = false ]]
|
||||
then
|
||||
echo "Using production endpoint"
|
||||
certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Renewal attempt complete"
|
||||
else
|
||||
echo "Unrecognised option for STAGING variable - check your configuration"
|
||||
|
||||
exit 8
|
||||
fi
|
||||
59
root/container-init.sh
Normal file
59
root/container-init.sh
Normal file
@ -0,0 +1,59 @@
|
||||
#!/command/with-contenv bash
|
||||
# shellcheck shell=bash
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo "================================================"
|
||||
echo "| __ _______ __ ___________________ |"
|
||||
echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |"
|
||||
echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |"
|
||||
echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |"
|
||||
echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |"
|
||||
echo "| |"
|
||||
echo "================================================"
|
||||
echo ""
|
||||
echo "Initialising container"
|
||||
echo "
|
||||
----------------------------------------------------------------------
|
||||
ENVIRONMENT
|
||||
----------------------------------------------------------------------
|
||||
PUID=${PUID}
|
||||
PGID=${PGID}
|
||||
TZ=${TZ}
|
||||
DOMAINS=${DOMAINS}
|
||||
EMAIL=${EMAIL}
|
||||
INTERVAL=${INTERVAL}
|
||||
STAGING=${STAGING}
|
||||
PROPOGATION_TIME=${PROPOGATION_TIME}
|
||||
GENERATE_DHPARAM=${GENERATE_DHPARAM}
|
||||
CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
|
||||
----------------------------------------------------------------------
|
||||
"
|
||||
|
||||
#Setting UID and GID as configured
|
||||
if [[ ! "${PUID}" -eq 0 ]] && [[ ! "${PGID}" -eq 0 ]]; then
|
||||
echo "Executing usermod..."
|
||||
mkdir "/tmp/temphome"
|
||||
usermod -d "/tmp/temphome" mrmeeb
|
||||
usermod -o -u "${PUID}" mrmeeb
|
||||
usermod -d /config mrmeeb
|
||||
rm -rf "/tmp/temphome"
|
||||
groupmod -o -g "${PGID}" mrmeeb
|
||||
else
|
||||
echo "Running as root is not supported, please fix your PUID and PGID!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Checking permissions in /config and /app."
|
||||
|
||||
if [ ! "$(stat -c %u /app)" -eq "${PUID}" ] || [ ! "$(stat -c %g /app)" -eq "${PGID}" ]
|
||||
then
|
||||
echo "Fixing permissions for /app (this can take some time)."
|
||||
chown -R mrmeeb:mrmeeb /app
|
||||
fi
|
||||
|
||||
if [ ! "$(stat -c %u /config)" -eq "${PUID}" ] || [ ! "$(stat -c %g /config)" -eq "${PGID}" ]
|
||||
then
|
||||
echo "Fixing permissions for /config (this can take some time)."
|
||||
chown -R mrmeeb:mrmeeb /config
|
||||
fi
|
||||
1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/type
Normal file
1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/type
Normal file
@ -0,0 +1 @@
|
||||
oneshot
|
||||
1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/up
Normal file
1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/up
Normal file
@ -0,0 +1 @@
|
||||
exec s6-setuidgid mrmeeb /certbot-prepare.sh
|
||||
1
root/etc/s6-overlay/s6-rc.d/container-init/type
Normal file
1
root/etc/s6-overlay/s6-rc.d/container-init/type
Normal file
@ -0,0 +1 @@
|
||||
oneshot
|
||||
1
root/etc/s6-overlay/s6-rc.d/container-init/up
Normal file
1
root/etc/s6-overlay/s6-rc.d/container-init/up
Normal file
@ -0,0 +1 @@
|
||||
/container-init.sh
|
||||
1
root/etc/s6-overlay/s6-rc.d/cron/finish
Normal file
1
root/etc/s6-overlay/s6-rc.d/cron/finish
Normal file
@ -0,0 +1 @@
|
||||
echo "$e" > /run/s6-linux-init-container-results/exitcode
|
||||
3
root/etc/s6-overlay/s6-rc.d/cron/run
Normal file
3
root/etc/s6-overlay/s6-rc.d/cron/run
Normal file
@ -0,0 +1,3 @@
|
||||
#!/command/with-contenv bash
|
||||
# shellcheck shell=bash
|
||||
exec crond -f
|
||||
1
root/etc/s6-overlay/s6-rc.d/cron/type
Normal file
1
root/etc/s6-overlay/s6-rc.d/cron/type
Normal file
@ -0,0 +1 @@
|
||||
longrun
|
||||
1
root/etc/s6-overlay/s6-rc.d/logs/finish
Normal file
1
root/etc/s6-overlay/s6-rc.d/logs/finish
Normal file
@ -0,0 +1 @@
|
||||
echo "$e" > /run/s6-linux-init-container-results/exitcode
|
||||
3
root/etc/s6-overlay/s6-rc.d/logs/run
Normal file
3
root/etc/s6-overlay/s6-rc.d/logs/run
Normal file
@ -0,0 +1,3 @@
|
||||
#!/command/with-contenv bash
|
||||
# shellcheck shell=bash
|
||||
tail -fn 0 /config/logs/renew.log
|
||||
1
root/etc/s6-overlay/s6-rc.d/logs/type
Normal file
1
root/etc/s6-overlay/s6-rc.d/logs/type
Normal file
@ -0,0 +1 @@
|
||||
longrun
|
||||
0
root/etc/s6-overlay/s6-rc.d/user/contents.d/cron
Normal file
0
root/etc/s6-overlay/s6-rc.d/user/contents.d/cron
Normal file
0
root/etc/s6-overlay/s6-rc.d/user/contents.d/logs
Normal file
0
root/etc/s6-overlay/s6-rc.d/user/contents.d/logs
Normal file
85
run.sh
85
run.sh
@ -1,85 +0,0 @@
|
||||
#!/bin/bash
|
||||
echo ""
|
||||
echo ""
|
||||
echo "================================================"
|
||||
echo "| __ _______ __ ___________________ |"
|
||||
echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |"
|
||||
echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |"
|
||||
echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |"
|
||||
echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |"
|
||||
echo "| |"
|
||||
echo "================================================"
|
||||
echo ""
|
||||
echo ""
|
||||
|
||||
|
||||
#Creating needed folders and files if they don't already exist
|
||||
if [ ! -d /config/.secrets ]
|
||||
then
|
||||
mkdir /config/.secrets
|
||||
fi
|
||||
|
||||
if [ ! -d /config/letsencrypt ]
|
||||
then
|
||||
mkdir /config/letsencrypt
|
||||
fi
|
||||
|
||||
if [ ! -f /config/.secrets/cloudflare.ini ]
|
||||
then
|
||||
touch /config/.secrets/cloudflare.ini
|
||||
fi
|
||||
|
||||
if [ ! -f /crontab.txt ]
|
||||
then
|
||||
touch /crontab.txt
|
||||
fi
|
||||
|
||||
if [ ! -s /config/.secrets/cloudflare.ini ]
|
||||
then
|
||||
echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing"
|
||||
|
||||
exit 8
|
||||
fi
|
||||
|
||||
#Securing cloudflare.ini to supress warnings
|
||||
chmod 600 /config/.secrets/cloudflare.ini
|
||||
|
||||
#Outputting Environment Variables to /etc/environment for use by cron-based scripts
|
||||
env >> /etc/environment
|
||||
|
||||
ln -s /config/letsencrypt /etc/letsencrypt
|
||||
|
||||
echo "Domains being added to the certificate are "$DOMAINS
|
||||
|
||||
echo "Propogation time is $PROPOGATION_TIME seconds"
|
||||
|
||||
echo "Creating certificates, or attempting to renew if they already exist"
|
||||
|
||||
if [[ $STAGING = true ]]
|
||||
then
|
||||
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
|
||||
certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Creation/renewal attempt complete"
|
||||
elif [[ $STAGING = false ]]
|
||||
then
|
||||
echo "Using production endpoint"
|
||||
certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
|
||||
echo "Creation/renewal attempt complete"
|
||||
else
|
||||
echo "Unrecognised option for STAGING variable - check your configuration"
|
||||
|
||||
exit 8
|
||||
fi
|
||||
|
||||
if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
|
||||
then
|
||||
echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
|
||||
openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
|
||||
fi
|
||||
|
||||
echo "$INTERVAL /renew.sh > /proc/1/fd/1 2>/proc/1/fd/2" > /crontab.txt
|
||||
|
||||
echo "Starting automatic renewal job. Schedule is $INTERVAL"
|
||||
crontab /crontab.txt
|
||||
|
||||
exec cron -f
|
||||
Loading…
x
Reference in New Issue
Block a user